Breaches and incidents
ICICI Bank (India): RBI fines Rs 97.80 lakh, including for reporting a cyber security incident late
RBI’s order dated 29 Apr 2025 (released 2 May 2025) penalised the bank under the Cyber Security Framework, KYC and card directions.
- Disclosed
- Verification
- Checked against a primary source
What happened
- RBI’s order dated 29 Apr 2025 (released 2 May 2025) penalised the bank under the Cyber Security Framework, KYC and card directions. Findings from the ISE 2023 inspection: “The bank failed to report a cyber security incident to RBI within the stipulated timeline”, failed to use robust alert software for certain categories of accounts, and levied late fees without sending some card statements.
- Root cause: the underlying incident is not identified by RBI or the bank.
- Attacker: not disclosed.
- Response: penalty; ICICI Bank disclosed the order to the exchanges on 2 May 2025.